PT-2019-4594 · Apache · Apache Spamassassin

Publicado 2019-12-11 · Atualizado 2019-12-11 · CVE-2019-11805

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache SpamAssassin (affected versions not specified)

Description The issue exists due to the failure to neutralize special elements used in operating system commands. This could allow a remote attacker to execute arbitrary commands on the target system by loading malicious rules or configuration files from update servers.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

BDU:2020-00654

CVE-2019-11805

Produtos afetados

Apache Spamassassin

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2018-11805 · Nota de Segurança
• https://openwall.com/lists/oss-security/2019/12/12/1 · Nota
• https://bdu.fstec.ru/vul/2020-00654 · Nota de Segurança
• https://debian.org/security/2019/dsa-4584 · Aviso do Fabricante